LogCarverGuard, an MCP proxy between an AI agent and SQL Server

LogCarverGuard is a proxy that acts as a barrier between an AI coding agent, such as Claude Code or Cursor, and a SQL Server database. This free software, version 0.1, restricts the actions the agent can perform on the database. The proxy communicates with the AI agent using the Managed Connection Protocol (MCP) and an API key, which maps to a specific SQL login.

The proxy impersonates the SQL login for each request, allowing the already set permissions to apply. The proxy does not add any extra permissions; it only restricts certain actions.

The software uses Microsoft's ScriptDom T-SQL parser to examine parsed statements, ignoring text within comments or string literals. Certain statements are always blocked, such as DROP TABLE, DROP DATABASE, RESTORE DATABASE, and RESTORE LOG. Additionally, statements like ALTER DATABASE ... SET, sp_executesql, and xp_cmdshell are restricted. The proxy blocks any attempt to revert to the service account (REVERT) or execute statements like GRANT, DENY, REVOKE, and BEGIN TRAN, COMMIT, ROLLBACK, or SAVE TRANSACTION.

In local mode, the AI tool runs on the user's machine, and every statement is blocked unless the environment variable LOGCARVERGUARD_READ_ONLY is set. The audit log records who, when, the SQL statement, and whether it was executed or blocked. The audit log is stored in a local SQLite file and has no tamper protection. Testing of LogCarverGuard included 200 test cases across five projects, all of which passed on November 5, 2026.